From dec9ce8263dfebefa6d99db5954cb47fe378470f Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Fri, 29 May 2026 18:44:06 +0530 Subject: [PATCH] fix(esp_tee): Reset crypto peripherals before the panic-induced reset --- .../esp_tee/include/private/esp_tee_binary.h | 8 +++++ .../esp_tee/subproject/main/CMakeLists.txt | 3 +- .../main/common/panic/esp_tee_panic.c | 9 +++++- .../main/soc/esp32c5/esp_tee_crypto_reset.c | 30 +++++++++++++++++++ .../main/soc/esp32c6/esp_tee_crypto_reset.c | 28 +++++++++++++++++ .../main/soc/esp32c61/esp_tee_crypto_reset.c | 22 ++++++++++++++ .../main/soc/esp32h2/esp_tee_crypto_reset.c | 30 +++++++++++++++++++ 7 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c create mode 100644 components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c create mode 100644 components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c create mode 100644 components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c diff --git a/components/esp_tee/include/private/esp_tee_binary.h b/components/esp_tee/include/private/esp_tee_binary.h index 5196dad1107..0abaa3e3a72 100644 --- a/components/esp_tee/include/private/esp_tee_binary.h +++ b/components/esp_tee/include/private/esp_tee_binary.h @@ -112,6 +112,14 @@ void esp_tee_configure_region_protection(void); */ void esp_tee_configure_apm_protection(void); +/** + * @brief Reset the crypto peripherals to a clean state. + * + * Mirrors esp_system_reset_modules_on_exit() in the non-TEE path. + * Intended to be called from the TEE panic handler before a software reset. + */ +void esp_tee_soc_reset_crypto_peripherals(void); + /** * @brief Switch to the REE app after TEE initialization is complete * diff --git a/components/esp_tee/subproject/main/CMakeLists.txt b/components/esp_tee/subproject/main/CMakeLists.txt index 9c0f7e3f366..6cd569cfa31 100644 --- a/components/esp_tee/subproject/main/CMakeLists.txt +++ b/components/esp_tee/subproject/main/CMakeLists.txt @@ -25,7 +25,8 @@ endif() # SoC specific implementation for TEE list(APPEND srcs "soc/${target}/esp_tee_secure_sys_cfg.c" "soc/${target}/esp_tee_pmp_pma_prot_cfg.c" - "soc/${target}/esp_tee_apm_prot_cfg.c") + "soc/${target}/esp_tee_apm_prot_cfg.c" + "soc/${target}/esp_tee_crypto_reset.c") list(APPEND srcs "soc/common/esp_tee_apm_intr.c") diff --git a/components/esp_tee/subproject/main/common/panic/esp_tee_panic.c b/components/esp_tee/subproject/main/common/panic/esp_tee_panic.c index 3fee6d506e3..ccf21e7c4d1 100644 --- a/components/esp_tee/subproject/main/common/panic/esp_tee_panic.c +++ b/components/esp_tee/subproject/main/common/panic/esp_tee_panic.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -18,6 +18,7 @@ #include "hal/cache_ll.h" #include "hal/cache_hal.h" #include "hal/apm_hal.h" +#include "soc/soc_caps.h" #if SOC_INT_PLIC_SUPPORTED #include "soc/plic_reg.h" @@ -56,6 +57,12 @@ static void tee_panic_end(void) esp_rom_output_tx_wait_idle(CONFIG_ESP_CONSOLE_UART_NUM); } + // Reset crypto peripherals before the panic-induced reset so the next boot + // sees them in a clean state. The SoC-specific implementation mirrors + // esp_system_reset_modules_on_exit() in the non-TEE path using register-level + // accesses. + esp_tee_soc_reset_crypto_peripherals(); + // Generate system reset esp_rom_software_reset_system(); } diff --git a/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c new file mode 100644 index 00000000000..a9e1ec6062e --- /dev/null +++ b/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c @@ -0,0 +1,30 @@ +/* + * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#include "soc/soc.h" +#include "soc/pcr_reg.h" + +#include "esp_tee.h" + +void esp_tee_soc_reset_crypto_peripherals(void) +{ + SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD); +} diff --git a/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c new file mode 100644 index 00000000000..1dde41e9401 --- /dev/null +++ b/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c @@ -0,0 +1,28 @@ +/* + * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#include "soc/soc.h" +#include "soc/pcr_reg.h" + +#include "esp_tee.h" + +void esp_tee_soc_reset_crypto_peripherals(void) +{ + SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD); +} diff --git a/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c new file mode 100644 index 00000000000..58013ff3755 --- /dev/null +++ b/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c @@ -0,0 +1,22 @@ +/* + * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#include "soc/soc.h" +#include "soc/pcr_reg.h" + +#include "esp_tee.h" + +void esp_tee_soc_reset_crypto_peripherals(void) +{ + SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD); +} diff --git a/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c new file mode 100644 index 00000000000..96a73fd8c46 --- /dev/null +++ b/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c @@ -0,0 +1,30 @@ +/* + * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#include "soc/soc.h" +#include "soc/pcr_reg.h" + +#include "esp_tee.h" + +void esp_tee_soc_reset_crypto_peripherals(void) +{ + SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN); + CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN); + CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN); + CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD); + REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD); +}